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Dear Sir: 



G *OUP 3600 



I, Jeffrey Starr, make this declaration of my own hand and on persona] 
knowledge, and state under penalty of perjury, as follows: 

Background 

1. I am an official of the United States Department of Defense on sabbatical to Goldman, 
S achs & Co. ("Goldman Sachs") under an Office of Personnel Management program 
(Section 3396 of Chapter 33, Part m, Title 5, United States Code) and pursuant to the 
terms of a December 2003 Memorandum of Agreement between the United States 
Department of Defense and Goldman, Sachs & Co. While at Goldman Sachs, I have 
been assigned to the Business Intelligence Group for most of ray work responsibilities, as 
well as to the Sovereign Risk Management and Advisory Group for other responsibilities 
Among my assignments in the Business Intelligence Group is the responsibility of 
assisting and advising the Regulatory Data Corporation ("RDC"), a licensee of the above 
identified application, it is in this context that I have been asked to provide my view as 
someone skilled in the art of analysis pertaining to security risks. While I am generally 
computer savvy, I am not a computer programmer. 

2. I am a career civil servant in the Senior Executi ve Service of the United States 
Government. I joined the Federal Government in 1986 and have served in a number of 
capacities in the United States Department of State and the Department of Defense. I am 
currently assigned to the Office of Special Operations and Low Intensity Conflict in the 
Department of Defense, where I have been since November 2001 . Prior positions in the 
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Government have included Deputy Assistant Secretary of Defense for Russia, Ukraine 
and Eurasia (1 998-2001), Acting Principal Deputy Assistant Secretary of Defense for 
International Security Policy (1996-1998), and Principal Director for Threat Reduction 
Policy (1994-1996). In these capacities and other prior assignments, I have developed 
expertise in a broad range of national security matters ranging from international 
negotiations, to weapons of mass destruction, to regional security, counterproliferation 
counterinsurgency and couaterterrorism activities, and other areas related to foreign 
organized crime and intelligence matters. Through such assignments, I have developed 
significant experience in different approaches to analyzing, anticipating and countering a 
broad range of security threats. Academically, I have a B.S. degree in mathematics from 
the University of Illinois and a Ph.D. in international relations from the Massachusetts 
Institute of Technology, and am an adjunct professor at Georgetown University in 
Washington D.C. I believe I am (and was as of the filing date of the Application) skilled 
in the fields of mathematics and security and risk analysis. I believe I am able to 
recognize and provide an opinion of the abilities of a person of ordinary skill in the fields 
of mathematics and security and risk anal ysis as of the time of the filing of the 
Application. 

Scope of Review 

3. In forming my opinions set forth in. this declaration, I have reviewed the following: 

(a) U.S. Patent Application Serial No. 09/772,427, entitled "Automated Political risk 
Management System," filed on 30 January 2001 by David Lawrence (the "Application"), 
and 

(b) Office Action mailed 24 February 2004 from Examiner Fults (the "Office Action") 

4. I have also relied on my personal expertise and professional knowledge and 
experience. 

Opinions 

5. I find that the Application sets forth a sufficiently clear and concise description of a 
system that has utility for evaluating risks in a standardized manner, in this case risks 
associated with politically identified people proposing financial transactions which could 
entail financial, legal, regulatory and/or reputational risks for financial institutions or 
other agencies. At the core of this system is a methodology for evaluating such risks in a 
standardized manner, necessary to facilitate communication wifliin any industry about the 
scale of risks faced in such situations as mentioned above. The compelling need to be 
able to evaluate risks in such a manner seems to me to be driven both by market factors 
and changes in the global financial and political-security situations. Whereas the 
financial industry market formerly focused on credit risk, as well as regulatory risk, in the 
conduct of its transactions, threats of money laundering and association with individuals 
who may have achieved wealth through illegal or illicit means, such as narcotics 
trafficking or corruption in foreign states, have increased over time. Compounding this 
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trend are changes in the international situation marked by market globalization, 
dissolution and transformation of political systems, terrorism, etc. Therefore, the 
methodology described and claimed in the Application is one which is useful and which 
can. provide greater objectivity and standardization in evaluating such risks. 

6. It is my view that someone skilled in the art of risk analysis at the time of filing the 
Application would be able to utilize the methodology provided in the Application and 
that the Application sets forth a methodology that is understandable to a person of 
ordinary skill in the art of assessing the nature and relative magnitude of the risks, 
calculated in a manner that permits and facilitates communication of such risk 
calculations to others engaged in similar activity. 

7. I understand that the purpose of the Application is to describe an. automated political, 
risk management system made up of a number of components: accumulated risk relevant 
information stored in a database, the ability to retrieve information in an automated 
manner, a rating system relating risk relevant criteria to algorithms for the purpose of 
deriving a risk quotient or other rating value, whose ultimate purpose is to give the user a 
standardized measure of the risk associated with engaging in activity with particul ar 

pol itically identified persons. 

8. I understand the nature of the information that would constitute the database as being 
related to individuals or entities (politically identified persons) with whom doing business 
(financial or otherwise) could entail risks for a user of the Application, Such a database 
could be populated with any risk relevant publicly available information (or other risk 
relevant information depending on the user's needs). A rating system would identify 
criteria for ascertaining what bits of information are risk-relevant for the intended 
purpose of the risk management system. A system for financial institutions, for example, 
would identify criteria (risk factors), such as prior involvement with illicit activity, 
nationality (if individuals from certain nations arc judged more likely to be higher risk for 
business purposes, etc.), and other factors. These criteria then would be weighted (using 
a numeric coefficient between 0 and 1) depending on expert-level assessments of their 
overall contribution to assessing risk relevance. For example, a criterion related to prior 
involvement in illicit financial activity coujd be more heavily weighed than nationality as 
being an indicator of future risk. From scoring of criteria and weighting them, an 
algorithm would be used to generate a "risk quotient" which I understand to be a numeric 
value that measures the risk normalized to a no-risk value. In this sense, the absolute 
numeric value assigned to a risk factor is irrelevant, since all risk weightings are 
normalized to a no-risk value. For example, a financial institution might conclude in the 
current world situation that dealing with a Canadian investor is risk free, at least insofar 
as nationality is concerned, whereas dealing with a Middle Eastern investor carries 
greater risk. In such a case, the algorithm, might assign a value of zero or one to a 
Canadian nationality, while it scores a Middle Eastern nationality at 10 (it could be any 
number greater than the 0 or 1). If all other nationalities are scored with values reflecting 
expert opinion about the risk of dealing with individuals of said nationality then a 
relative score i 5 established essentially ranking the nationality criterion in accordance 
with expert views of the associated risks. 
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9. An exemplary algorithm could be: 



aX + bY + ... +cZ~R 

where a, b, c are the relative weight factors (ranging from 0 to 1), 

and X, Y, Z axe numerical scores assigned to variables associated with criteria 
(e.g., if a criterion is nationality, a variable could be Canada or Russia), 

and R is the risk quotient. 

10. The sophistication of the automated risk management system described by the 
Application need not imply a sophisticated algorithm, as seen by the linear equation in 
paragraph 10. Indeed, this is the method of calculation described in paragraph [0049] of 
the Application: "A risk quotient can be calculated by multiplying a weighted numerical 
value of the specific information times the category weighting." From my perspective, 
the uniqueness of the system pertains more to the development of the criteria and 
weighting schemes and by the database that supports calculation of the risk quotient. 

1 1 . I find the terms used in the Application to be clear and understandable, and therefore 
understand how the methodology presented in the Application addresses the objectives of 
the Application as put forth in paragraph [0007] and as recited in the claims. 

1 2. The examiner has voiced concern about the use of the word "quotient" in describing 
the calculated result of the Application methodology. It is correct that in normal 
mathematical meaning, quotient involves the division of two values. However, the 
meaning derived from such a mathematical operation relates to the normalization of risk 
valuations to non-risk valuations (hence the notion of a comparison, relative score or, 
equivalently, a ratio, keeping in mind also that division is a form of multiplication). ' 
Moreover, J understand the use of the word quotient to refer to a calculated result that 
does not necessarily carry any implication of a specific mathematical operation, much 
like the contemporary use of the term "intelligence quotient" does not directly imply a 
division operation. 

13. The examiner has voiced concern about the absence of a definition for a specific 
threshold to distinguish no risk and risk outcomes, the absence of a list of evaluation 
factors, and the absence of a specific equation. I believe that the Application intends to 
present a methodology for specifying a risk management system, whose specific 
applications may change depending on the nature of the user's interests and business. A 
set of relevant risk factors to an investment banker or hedge fund manager might not be 
the same as those for an insurance company or a government, for example. In such cases, 
it would be advisable to adjust the specific criteria, risk scores and weightings to the 
needs of the user. Moreover, even for a single user, weighting factors or risk factor 
scores might change over time. For example, 20 years ago, a Saudi investor might have 
posed a different, indeed lower, risk than a Saudi investor could today. Certain charities 
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would fall into a similar general characterization. So, it seems clear there can be no 
absolute numeric valuations, and there need be no absolute thresholds, for the 
methodology to provide value to users. Finally, although no equations are presented in 
the Application in traditional form, the equation illustrated in. paragraph 10 above is 
described in prose in the Application. But one unique contribution of the Application is 
the specification of an entire interrelated system for managing risk in an automated 
manner, not in asserting the accuracy of one equation form over another. 

14. The examiner has voiced concern that users would have to conduct an undue amount 
of experimentation to use the invention. I believe that it is not so much experimentation 
that would be required of users, but that users would have to adapt the invention to their 
specific uses by specifying, modifying, or applying criteria relevant to their own industry 
or interests in the. calculation of the risk quotient. This is a process of application, not 
experimentation- Generally, given the stated objectives of the invention, that is to 
develop an automated risk management system focused on politically identified persons, 
the criteria discussed in the Application would be similar across a wide band of users, 
although additional criteria would have to be specified, and some users may have unique 
cri teria against which they would wish to search the database. It is correct that such 
specification of criteria includes a subjective interpretation, but that pertains more to the 
nature of assessing risk based on modeling behavior rather than a flaw in the concept of 
the invention. Additionally/the "subjective" assessment of what criteria are relevant for 
a given user would normally be made by experts and other experienced persons in that 
industry (e.g., financial industry), reflecting professional experience. It is the application 
of the algorithm to these criteria which provides an objective assessment score (i.e., the 
risk quotient), which provides persons in an industry responsible for assessing risk with 
an objective and standardized way to evaluate and communicate with others the 
magnitude of risk to which they would be exposed in any particular transaction. 



Conclusion 



15. As someone skilled in the art of identifying and evaluating risk, as well as in. the art 
of mathematics, I find the Application to be sufficiently clear with regard to its terms and 
process flow to understand its purpose, the logic of the model, the methodology for how 
an automated system would be constructed and used to generate a risk quotient, and the 
meaning of the risk quotient itself in practical use to identify potential risk involved in 
transactions, for example financial, transactions. I believe others skilled in these arts 
would arrive at the same conclusions. In particular, as of the filing date of the 
Application, I believe a person of ordinary skill in the art of identifying and evaluating 
risk could use the claimed invention without undue experimentation based on the 
disclosure. 

I further declare that all statements made herein of my own knowledge are true and that 
all statements made on information and belief are believed to be true; and further that 
these statements were made with the knowledge that willful false statements and the like 
so made are punishable by fine or imprisonment, or both, under Section 1 00 1 of Tide 1 8 
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of the United States Code, and that such, willful false statements may jeopardise the 
validity of the patent application. 



Date Jeffrey 



ffrey Star/ 
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